Washington Legislative Office 915 15th Street, 6th FL Washington DC 20005 T: 202-544-1681 aclu.org

Susan Herman President

Anthony Romero Executive Director

Ronald Newman National Political Director

June 25, 2019

The Honorable Jerrold Nadler Chairman U.S. House Committee on the Judiciary 2138 Rayburn House Office Building Washington, D.C. 20515

The Honorable Doug Collins Ranking Member U.S. House Committee on the Judiciary 2138 Rayburn House Office Building Washington, D.C. 20515

Dear Chairman Nadler and Ranking Member Collins,

The ACLU recently received documents in response to Freedom of Information Act (FOIA) litigation regarding significant privacy and civil liberties violations related to the call detail record (CDR) program under Section 215 of the Patriot Act, which is set the expire at the end of this year. The documents reveal publicly for the first time that the NSA had yet another compliance violation in October 2018 resulting in the unlawful collection of CDRs. This new incident came just months after the agency publicly announced in June 2018 that it had taken steps to fully remedy prior compliance violations that similarly led to the unlawful collection of records and had required the deletion of all CDRs collected since 2015. 1 In addition, the documents reveal that elements within the Office of the Director of National Intelligence concluded that compliance violations in 2018 had a significant impact on privacy and civil rights, though individuals impacted were seemingly never notified of such violations.

These documents provide further evidence that the NSA has consistently been unable to operate the call detail record program within the bounds of the law. Thus, we urge you to end the flawed Section 215 call detail record authority once and for all. In addition, we urge you to investigate and make public additional information about these compliance violations to inform the debate over what additional reforms to Section 215 and other authorities are necessary to protect our rights.

1 NSA Press Release, “NSA Reports Data Deletion,” (June 28, 2018), https://www.nsa.gov/news-features/press-room/Article/1618691/nsa-reports-data-deletion/

I. Timeline of Events

The following is a timeline of events related to the call detail record program, based on information contained in the newly released FOIA documents and other information publicly reported.

November 2017: There is a compliance violation related to Section 215’s call detail record authority.

February 16, 2018: NSA analysts observe anomalies in call detail records produced by a provider. The provider later confirms that some of the records produced contained inaccurate information. The NSA also concludes that some of the records produced exceed the bounds of what had been authorized by the Foreign Intelligence Surveillance Court (FISC).

April 10, 2018: The NSA informs Congressional intelligence committees of the February 2018 incident.

May 23, 2018: The NSA begins deletion of all records produced under Section 215’s call detail record authority since 2015.

June 28, 2018: The NSA issues a public release revealing that it had begun deleting call records on May 23, 2018 due to “technical irregularities” that resulted in collection of some records the agency was not authorized to receive. The agency release stated that the “root cause of the problem has since been addressed for future CDR acquisitions.2”

October 12, 2018: NSA analysts note an anomaly in call detail records produced by a provider. Records indicate that the Office of Civil Liberties, Privacy, and Transparency will assess the impact of this incident following the full investigation.

Mid to late 2018: After initiating the process to purge all CDR records in May 2018, the NSA resubmits approved selectors to providers and receives responsive call detail records. The total number of call detail records collected by the agency in 2018 is reportedly 434,238,543, which includes purged and newly collected records.

March 4, 2019: News reports, which have never been confirmed by the NSA, indicate the call detail record program has been shut down.

II. New Information Revealed by the FOIA Documents

The newly released FOIA documents publicly reveal several key facts that were previously withheld from the public.

2 Id.

First, the documents reveal that there were compliance incidents in November 2017 and February 2018, related to Section 215’s call record authority.

According to the newly released FOIA documents, on February 16, 2018, NSA analysts observed an anomaly in call detail records produced by a provider under Section 215 of the Patriot Act.3 Subsequently, the provider confirmed that some of the records that had been produced contained inaccurate information, with some records provided to the NSA that exceeded the bounds of what had been authorized by the Foreign Intelligence Surveillance Court (FISC). The NSA notified the Congressional intelligence committees of the February incident on April 10, 2018.4 The documents also reference a November 2017 compliance violation but provide little information about this incident.

Second, the documents reveal that the impact of the 2018 compliance violations was significant and may have impacted subsequent surveillance and targeting decisions. However, it does not appear that the agency took steps to notify individuals of any privacy violations.

According to the documents, the Office of Civil Liberties, Privacy, and Transparency (CLPT), which reports directly to the Director of National Intelligence (DNI), assessed that the incident had a “significant impact on civil liberties and privacy.”5 In addition, the NSA reportedly “relied” on inaccurate information in targeting requests that were approved by the Foreign Intelligence Surveillance Court (FISC).6 The NSA informed the FISC of this error, but the redacted documents do not provide further information regarding whether this resulted in the improper surveillance or targeting of individuals. Moreover, the documents do not indicate that any remedial action taken by the agency included notification to individuals whose information may have been improperly obtained as a result of the errors.

Third, the documents reveal that the 2018 incidents likely contributed to the agency’s decision to begin deleting all records collected since 2015 under Section 215’s call detail record program.

In June 2018, the NSA publicly disclosed that on May 23, 2018, it had begun deleting all records collected under Section 215’s call record authority. The public release stated that the records were being deleted because several months prior “NSA analysts noted technical irregularities in some data received from telecommunications service providers.” According to the NSA, this resulted in the production of “some [call detail records] that the NSA was not authorized to

3 ACLU FOIA Documents, pp. 008. 4 ACLU FOIA Documents, pp. 051. 5 ACLU FOIA Documents, pp. 050. 6 ACLU FOIA Documents, pp. 050-51.

receive,” which could not be identified and isolated. However, the agency stated that the “root cause of the problem has since been addressed for future CDR acquisitions”.7

Fourth, the documents reveal that NSA had yet another compliance violation in October 2018, despite the fact that the agency had stated in June 2018 that it has resolved the root causes of prior compliance violations.

On or around October 3, 2018, a provider again began producing erroneous call detail records.8 The NSA suspended data flow from the provider, who subsequently indicated that it had resolved the problem.9 The CLPT indicated that it would assess the privacy and civil liberties impact of the October incident following investigation. The oversight report for the first quarter of 2019, which may contain further information about this incident, was not included in the FOIA documents. The ACLU intends to file a subsequent FOIA request requesting this document.

News reports in March indicated that the NSA had suspended the call detail record program. However, the agency has not publicly confirmed such reports. Thus, it is unclear whether the October or subsequent incidents contributed to an agency decision to suspend the program.

III. Additional Information Needed

Despite the new information, questions remain regarding the government’s use of the Section 215 call detail record authority. As the public debates the reauthorization of Section 215, we must have a full understanding of the compliance issues that have plagued this program and the effect they have had. Thus, we urge you to use every tool at your disposal to fully investigate these incidents, and publicly disclose:

• Has the NSA suspended the Section 215 call detail record program? If theagency has suspended the program, what factors led to this decision and doesthe agency believe it has the authority to restart the program?

• What is the CLPT’s assessment of the privacy and civil liberties impact ofthe October 2018 or any subsequent compliance incidents?

7 NSA Press release, supra note 1. 8 ACLU FOIA Documents, pp. 033. 9 Id.

• How many records were improperly collected as a result of the 2017 and2018 compliance incidents? How many individuals have been notified thatthey may have been impacted by improper collection?

• Did the NSA or other agencies undertake surveillance or targeting based onFISC approvals that involved the submission of inaccurate informationreceived under the Section 215 CDR program?

• What has been the total cost of remedying the compliance incidents from2017-19, including staff time or compensation given to providers? What hasbeen the total cost of operating the call detail record program since 2015?

• Why did the remedial efforts undertaken by the agency in response to theNovember 2017 incident and February 2018 incident fail to prevent furthercompliance problems? Has the agency completed the deletion of CDR recordsthat was initiated on May 23, 2018?

If you would like to discuss this issue further, feel free to contact Senior Legislative Counsel, Neema Singh Guliani at nguliani@aclu.org.

Sincerely,

Ronald Newman National Political Director

Neema Singh Guliani Senior Legislative Counsel